SQL injection
/ ESS-cue-ell in-JEK-shun /
SQL injection is a classic attack where a user types not just data but extra database commands, and the program runs them by mistake. It happens when code glues raw user input straight into a SQL query — so the input stops being a name and starts being an instruction.
Picture a form that asks for your username and builds a query around it. If you type a normal name, fine. But type something crafted like ' OR '1'='1 and the query's meaning quietly changes, perhaps letting you log in as anyone, dump the whole table, or delete it. The app trusted the input as plain text; the database read part of it as a command.
The fix is wonderfully simple and absolute: never paste raw input into a query. Use 'parameterized queries' (also called prepared statements), where you send the SQL and the values down separate channels. The values are then treated only as data — never as commands — and the trick simply stops working.
// vulnerable: input glued into the query
"SELECT * FROM users WHERE name = '" + input + "'"
// safe: value sent separately as a parameter
db.query("SELECT * FROM users WHERE name = ?", [input])Top: raw input becomes part of the SQL. Bottom: the '?' keeps the value as data, not a command.
SQL injection has topped the web's risk lists for over two decades, and it's still common — because the unsafe way (just glue the strings together) is also the easiest way to write the code.